CVE-2004-0230 additions and Linux Kernel fix

[Marcus Meissner <meissner () suse de>]

Hi,

CVE-2004-0230 is an old standing TCP protocol issue complained about by shitty network vulnerability scanners (I am 
looking at you Nessus).

There has been however some progress since 2004...

It has new references to add:

RFC 5961 was written to address this CVE: https://tools.ietf.org/html/rfc5961

And the Linux Kernel has implemented this in

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=282f23c6ee343126156dd41218b22ece96d747e3

commit 282f23c6ee343126156dd41218b22ece96d747e3
Author: Eric Dumazet <edumazet () google com>
Date:   Tue Jul 17 10:13:05 2012 +0200

    tcp: implement RFC 5961 3.2
    
    Implement the RFC 5691 mitigation against Blind
    Reset attack using RST bit.
    
    Idea is to validate incoming RST sequence,
    to match RCV.NXT value, instead of previouly accepted
    window : (RCV.NXT <= SEG.SEQ < RCV.NXT+RCV.WND)
    
    If sequence is in window but not an exact match, send
    a "challenge ACK", so that the other part can resend an
    RST with the appropriate sequence.
    
    Add a new sysctl, tcp_challenge_ack_limit, to limit
    number of challenge ACK sent per second.
    
    Add a new SNMP counter to count number of challenge acks sent.
    (netstat -s | grep TCPChallengeACK)
    
    Signed-off-by: Eric Dumazet <edumazet () google com>
    Cc: Kiran Kumar Kella <kkiran () broadcom com>
    Signed-off-by: David S. Miller <davem () davemloft net>

Ciao, Marcus